Reports Reader

Description

Can read sign-in and audit reports.

Details

Users with this role can view usage reporting data and the reports dashboard in Office 365 admin center and the adoption context pack in Power BI. Additionally, the role provides access to sign-on reports and activity in Microsoft Entra ID and data returned by the Microsoft Graph reporting API. A user assigned to the Reports Reader role can access only relevant usage and adoption metrics. They don't have any admin permissions to configure settings or access the product specific admin centers like Exchange.

Directory Actions7

• microsoft.azure.serviceHealth/allEntities/allTasks
• microsoft.directory/auditLogs/allProperties/read
• microsoft.directory/provisioningLogs/allProperties/read
• microsoft.directory/signInReports/allProperties/read
• microsoft.office365.network/performance/allProperties/read
• microsoft.office365.usageReports/allEntities/allProperties/read
• microsoft.office365.webPortal/allEntities/standard/read

Graph API Permissions16

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

• AuditLog.Read.All
• AuditLogsQuery-Entra.Read.All
• AuditLogsQuery.Read.All
• ChangeManagement.Read.All
• Directory.Read.All
• NetworkAccess-Reports.Read.All
• ProvisioningLog.Read.All
• Reports.Read.All
• ReportSettings.Read.All
• ServiceActivity-Exchange.Read.All
• ServiceActivity-Microsoft365Web.Read.All
• ServiceActivity-OneDrive.Read.All
• ServiceActivity-Teams.Read.All
• ServiceHealth.Read.All
• ServiceMessage.Read.All
• ServiceMessageViewpoint.Write